Twitter Phishing Campaign Spreading Via Direct Messages

I got the impression that lately the amount of phishing attacks via social media was not as great as we have seen in the past. But just as I logged in to Twitter today I noticed that I had received two direct messages, and they both had a very similar message.

Two days ago I received the first message, and when I tried to verify if it was a link spreading malware, or a phishing site, the URL was already inactive. Now when I received another one I wanted to look at it quickly, and at the time of writing the phishing site is still active.

The two messages which I received had more or less the same structure, the only difference is the choice of URL shortener, and a word which has been replaced. The two different URL shorteners were and

“hey, someone is spreading nasty rumours about you URL”

“hey, someone is spreading terrible rumours about you URL”

What happens if you click the URL which is in the message? You will be redirected to the website http://twi[CUT] where the attacker has created a rogue Twitter login-page, and if you enter your credentials they will end up in the wrong hands. The stolen credentials will most likely be used to find more victims, but also to maybe find victims on other social media.

After the victims has entered their credentials they will be redirected to a website giving them a fake “404” error code page. Just after 2 seconds the victim will then be redirected to the real Twitter login page.

In the first message I got, the shortened URL redirected to a domain very similar to the one being exploited in the new campaign I’m writing about now. The domain in the previous message was This is an indication that its the same people behind the campaigns.

Fellow researchers at Kaspersky Lab have also seen indications that a wave of phishing attacks are being aimed at Facebook. Whether or not the two campaigns are related is at this time impossible to say. Some screenshots of the Facebook campaign can be found below:

Fellow researchers at Kaspersky Lab have also indications that a wave of phishing attacks are being exploited at Facebook, if the two campaigns are related is at the time impossible to say. Some screenshot of the Facebook campaign can be found below:

At the moment we are working on collecting more URL’s in this campaign, if you are aware of any URLs, do not hesitate to contact us. You can contact me on Twitter by tagging @JacobyDavid

Also remember to be very careful when you enter your personal credentials on any site.

Twitter Phishing Campaign Spreading Via Direct Messages

Your email address will not be published. Required fields are marked *



Lazarus targets defense industry with ThreatNeedle

In mid-2020, we realized that Lazarus was launching attacks on the defense industry using the ThreatNeedle cluster, an advanced malware cluster of Manuscrypt (a.k.a. NukeSped). While investigating this activity, we were able to observe the complete life cycle of an attack, uncovering more technical details and links to the group’s other campaigns.

Sunburst backdoor – code overlaps with Kazuar

While looking at the Sunburst backdoor, we discovered several features that overlap with a previously identified backdoor known as Kazuar. Our observations shows that Kazuar was used together with Turla tools during multiple breaches in past years.

Lazarus covets COVID-19-related intelligence

As the COVID-19 crisis grinds on, some threat actors are trying to speed up vaccine development by any means available. We have found evidence that the Lazarus group is going after intelligence that could help these efforts by attacking entities related to COVID-19 research.

Sunburst: connecting the dots in the DNS requests

We matched private and public DNS data for the SUNBURST-malware root C2 domain with the CNAME records, to identify who was targeted for further exploitation. In total, we analyzed 1722 DNS records, leading to 1026 unique target name parts and 964 unique UIDs.

Subscribe to our weekly e-mails

The hottest research right in your inbox